abusing-shadow-credentials-for-privesc

Auditing and Remediating Shadow Credentials in Active Directory

Security Advisory: This guide provides defense and audit procedures for identifying, monitoring, and remediating overly permissive write access to msDS-KeyCredentialLink (Shadow Credentials) in Active Directory environments.

Overview

The Shadow Credentials attack vector stems from misconfigured Active Directory Access Control Lists (ACLs) where non-administrative principals possess write permissions over the msDS-KeyCredentialLink attribute of user or computer accounts. This attribute normally stores raw public keys ("Key Credentials") used by Windows Hello for Business and Microsoft Entra ID device registration for passwordless PKINIT Kerberos authentication.

When access permissions are too permissive — such as unconstrained GenericWrite, GenericAll, WriteProperty, or AddKeyCredentialLink Access Control Entries (ACEs) — an unauthorized principal could append a key credential to an account, bypass password controls, and obtain Kerberos tickets.

Defending against this vulnerability requires establishing strict access-controls, enabling granular directory service auditing, and maintaining proactive credential-management hygiene across all directory objects.

When to Use

• When auditing Active Directory Discretionary Access Control Lists (DACLs) for excessive write privileges.
• When configuring Windows Security Event logging and SIEM correlation rules for directory modifications.
• When performing identity security posture assessments and tiering model reviews.
• When cleaning up legacy or unauthorized key credentials from Active Directory objects.
• When establishing least-privilege controls for hybrid identity and device registration service accounts.

Prerequisites

• Read access to Active Directory objects via LDAP / LDAPS (ports 389 / 636).
• Domain administrator or delegated audit privileges to inspect and remediate DACLs.
• Domain Controllers running Windows Server 2016 or later with Advanced Audit Policy configured.
• Audit tooling installed in a secure administrative workstation:

  # Python ldap3 or pyWhisker for attribute enumeration
  python3 -m pip install ldap3
  # Certipy for certificate template and key credential auditing
  pipx install certipy-ad